Application Security Engineer

Cybersecurity Jobs; Palo Alto (CA); On-site; USD 100,000 - 258,000; Full time

Job summary

SpaceXSI is seeking an Application Security Engineer to safeguard cloud-native apps across the SDLC. The role focuses on secure coding, CI/CD security, and security for AI projects, including OWASP LLM Top 10.

You will perform detailed code reviews, design guidelines, and embed security into pipelines while collaborating with dev teams. Knowledge of OWASP Top 10 and strong communication skills are essential.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, or related field required.
• 3-5 years of application security experience with emphasis on code security.
• Deep understanding of secure coding, security frameworks, and OWASP Top 10.

Responsibilities

• Perform in-depth code reviews and static analysis to identify vulnerabilities.
• Design secure coding guidelines and development-team best practices.
• Embed security into CI/CD pipelines and support DevSecOps workflows
• Conduct threat modeling and risk assessments with mitigation plans.
• Own vulnerability tracking and remediation guidance for teams
• Support incident response activities related to application security
• Monitor emerging cloud-native and AI threats to strengthen defenses
• Evaluate and secure SBOMs and software supply chains

Skills

Code security

Secure coding

DevSecOps

Threat modeling

Communication skills

Education

Bachelor's degree in CS/Cybersecurity

Tools

Burp Suite

OWASP ZAP

SBOM tools

CI/CD security

Python

Rust

Job description

SpaceXSI is hiring an Application Security Engineer to help safeguard cloud-native applications and systems across the software development lifecycle. The focus spans secure code practices, CI/CD pipeline security, and security work for AI-related applications, including the OWASP LLM Top 10.

What you’ll do

• Perform in-depth code reviews and static analysis to find and mitigate vulnerabilities across applications
• Design and implement secure coding guidelines and development-team best practices
• Partner with development teams to embed security into the CI/CD pipeline and support DevSecOps workflows
• Conduct threat modeling and risk assessments, then define mitigation strategies for identified risks
• Own vulnerability tracking and remediation, including providing guidance to development teams
• Support incident response activities related to application security
• Continuously monitor emerging threats and trends in cloud-native technologies and AI to strengthen security measures
• Evaluate and secure software supply chains, producing and maintaining Software Bills of Materials (SBOMs)
• Address security risks specific to AI and machine learning models, with emphasis on the OWASP LLM Top 10

Required qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, or a related field
• 3-5 years of experience in application security with a strong focus on code security
• Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (including OWASP Top 10)
• Proficiency in Python or Rust, including applying secure coding practices in these languages
• Experience securing CI/CD pipelines and implementing DevSecOps practices
• Familiarity with software supply chain security and SBOM generation tools
• Experience with security testing tools such as Burp Suite and OWASP ZAP, plus static and dynamic code analysis
• Understanding of AI/ML security implications, particularly those in the OWASP LLM Top 10
• Strong communication skills to explain complex security issues to both technical and non-technical audiences

Technologies you may work with

• Python, Rust
• Burp Suite, OWASP ZAP
• SBOM
• GCP, AWS, Azure

Preferred skills and experience

• Experience with cloud platforms (including GCP, AWS, Azure) and their security features
• Relevant security certifications such as CSSLP and OSWE
• Background in data privacy and compliance regulations for cloud-native applications and AI systems
• Experience with GitOps and infrastructure-as-code security
• Familiarity with federated learning and privacy-preserving machine learning techniques
• Experience building custom security tooling to enhance and automate security processes
• Interest in using AI to automate security tasks and improve efficiency
• Contributions to open-source security projects or tools
• Experience securing AI/ML models and data pipelines

Compensation and benefits

$100,000 - $258,000 USD per year. Base salary is part of SpaceXSI’s total rewards package, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks.

Location: Palo Alto, CA (onsite)